CVE-2016-1703

CVE-2016-1703 refers to multiple unspecified vulnerabilities in Google Chrome/Chromium up to version 51.0.2704.79, which could allow a remote attacker to cause a denial of service or potentially other impact via unknown vectors. The Mageia advisory explicitly ties CVE-2016-1703 to Chromium 51.0.2...

CVE-2016-1707

CVE-2016-1707 is a URL spoofing issue in Google Chrome on iOS where an invalid URL could be replaced with about:blank, allowing spoofed URL display. It affects Chrome before 52.0.2743.82 and is listed alongside other vulnerabilities (e.g., 1706, 1708–1711, 5127–5137). Debian/OpenSUSE advisories a...

CVE-2016-5216

CVE-2016-5216 is a use-after-free in the PDFium component of the Chromium browser, leading to a potential out-of-bounds memory read via a crafted PDF file. Affected product in the public data is Chromium (PDFium). The issue occurs in the PDFium code path and is listed among multiple CVEs in Arch ...

CVE-2017-5014

CVE-2017-5014 is a heap overflow in the Skia component of Google Chromium/Chromium-based browsers. Affected: Chromium before 56.0.2924.76 (Linux/Windows/Mac) and Android builds (56.0.2924.87). Impact: remote attacker could trigger out-of-bounds memory access through a crafted HTML page, potential...

CVE-2017-5102

CVE-2017-5102 affects Google Chrome (Skia) prior to 60.0.3112.78 on Linux, Windows, macOS, and Android. The issue is caused by use of an uninitialized value in Skia, allowing a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. Public refere...

CVE-2017-5103

CVE-2017-5103 concerns Google Chrome and Chromium browsers where a flaw in the Skia library—an uninitialized value—could allow a remote attacker to read potentially sensitive data from a process’s memory via a crafted HTML page. Affected products include Chrome on Linux, Windows, and macOS, with ...

CVE-2022-3312

CVE-2022-3312 affects Google Chrome on ChromeOS, where VPN input handling had insufficient validation of untrusted input before version 106.0.5249.62. The underlying issue is in VPN-related code, enabling a local attacker with physical access to bypass managed device restrictions. The evidence co...

CVE-2022-4914

CVE-2022-4914 is a heap buffer overflow in Chrome’s PrintPreview (Chromium) prior to 104.0.5112.79. The issue allows an attacker, by convincing a user to install a malicious extension and visit a crafted HTML page, to potentially cause heap corruption. Affected software is Google Chrome (Chromium...

CVE-2026-10007

CVE-2026-10007 describes a use-after-free in the SVG handling of Google Chrome (Chromium-based) that can allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability affects Chrome builds prior to 148.0.7778.216 and is classified with high severi...

CVE-2026-11192

AffectedSoftware : Google Chrome (Password Manager). Vulnerability : Insufficient validation of untrusted input in Password Manager allows a remote attacker to perform UI spoofing via malicious network traffic. Impact : UI spoofing could mislead users or steal credentials if leveraged against the...

CVE-2026-13027

CVE-2026-13027 is a use-after-free in Chrome’s FileSystem prior to 149.0.7827.197, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected: Google Chrome (FileSystem component); root cause: use-after-free vulnerability; impact: heap corruption with high...

CVE-2026-17663

CVE-2026-17663 affects Google Chrome on Android prior to 151.0.7922.72. The issue is "Insufficient validation of untrusted input in GPU" in the renderer, allowing a remote attacker who compromises the renderer process to potentially escape the sandbox via a crafted HTML page. The Chrome release n...

CVE-2026-17804

CVE-2026-17804 is a use-after-free in Chrome/Chromium’s Media component that could enable a sandbox escape when a renderer process is compromised via a crafted HTML page. The vulnerability affects Chrome prior to 151.0.7922.72 and is described across multiple sources (NVD, Debian, Red Hat, CIRCL,...

CVE-2026-18003

CVE-2026-18003 concerns Google Chrome on iOS, where an inappropriate implementation in Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to perform UI spoofing via a crafted HTML page. The NVD entry notes a Chromium-based, low-severity issue (CVSS v3.1: 4.3, MEDIUM) with attack vect...

CVE-2026-78895

An information leak in the Paint component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. The Red Hat advisory further notes this could lead to unauthorized access to sensitive information . The CVSS v3.1 base sco...

CVE-2026-9887

CVE-2026-9887 is a use-after-free vulnerability in the Chromium-based Proxy component of Google Chrome, exploitable via a crafted PAC script to achieve remote code execution. The flaw affects Chrome before version 148.0.7778.216, and Google released a stable-channel fix in 148.0.7778.216/217 (Win...

CVE-2013-2901

CVE-2013-2901 corresponds to an integer overflow in ANGLE used by Google Chrome (renderer code paths libGLESv2/renderer/Renderer9.cpp and Renderer11.cpp). The issue arises in ANGLE, and, per the description, could enable a remote attacker to cause a denial of service or potentially other impact v...

CVE-2013-6657

CVE-2013-6657 affects Blink’s XSS auditor in Google Chrome prior to 33.0.1750.117. The description from multiple sources states that the XSS auditor’s handling of FORM elements within HTTP requests could insert the about:blank URL, enabling a bypass of the Same Origin Policy and allowing a leakag...

CVE-2014-1743

CVE-2014-1743 is a Blink use-after-free in StyleElement::removedFromDocument (core/dom/StyleElement.cpp) affecting Google Chrome prior to 35.0.1916.114. Exploitation could crash the application (DoS) with crafted JavaScript triggering tree mutations; other impact is noted as unspecified. Remediat...

CVE-2014-3167

CVE-2014-3167 refers to multiple vulnerabilities in Google Chrome/Chromium prior to version 36.0.1985.143 that could allow a denial of service or other impact via unknown vectors. The connected documents confirm the issue is part of a set of Chromium flaws fixed in subsequent Chromium/Chrome upda...

CVE-2015-1259

The CVE-2015-1259 entry is confirmed in connected sources as a PDFium memory initialization issue in Google Chrome/Chromium prior to 43.0.2357.65. The root cause is an uninitialized memory condition in the PDFium component, which can allow a remote attacker to cause a denial of service or potenti...

CVE-2015-1282

CVE-2015-1282 refers to multiple use-after-free vulnerabilities in pdfium (fpdfsdk/src/javascript/Document.cpp) used by Google Chrome before 44.0.2403.89. The underlying issue affects the Document::delay and Document::DoFieldDelay paths, allowing a remote attacker to cause a denial of service or ...

CVE-2015-6759

CVE-2015-6759 affects Chromium/Blink: the shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp did not ensure a LocalStorage origin was unique, enabling information leakage via blob: URLs. The issue is documented for Chrome before 46.0.2490.71. A fix was released with Chrom...

CVE-2015-6774

CVE-2015-6774 is a use-after-free in the Chrome/Chromium Extensions bindings. A crafted JavaScript payload in renderer/loadtimes_extension_bindings.cc (GetLoadTimes) can trigger a crash or potentially broader impact, leading to a denial of service and unspecified effects. Affected product: Google...

CVE-2016-1613

CVE-2016-1613 affects Google Chrome’s pdfium formfiller, with the root cause in use-after-free destruction of IPWL_FocusHandler and IPWL_Provider objects. The vulnerability is triggered by crafting a PDF document and can lead to denial of service or potentially other impact. Affected software/ver...

CVE-2016-1657

CVE-2016-1657 affects Google Chrome/Chromium. The WebContentsImpl::FocusLocationBarByDefault function mishandles focus for certain about:blank pages, allowing a remote attacker to spoof the address bar via a crafted URL. Affected version range is before 50.0.2661.75 (Chrome/Chromium). Public advi...

CVE-2016-1658

CVE-2016-1658 affects Google Chrome’s Extensions subsystem, where GetOrigin-based origin comparisons could allow a malicious extension to access sensitive information and leak data across origins. The vulnerability is tied to how file: URL origins were handled, enabling potential leakage via exte...

CVE-2016-3679

CVE-2016-3679 covers multiple vulnerabilities in Google V8 (pre-4.9.385.33) as used by Chromium/Chrome (before 49.0.2623.108). The documented impact per NVD is possible denial-of-service and other effects. OpenSUSE/Nessus references indicate Chromium patching to 4.9.385.33 (Chrome 49.0.2623.108) ...

CVE-2016-5132

Summary: CVE-2016-5132 targets Google Chrome’s Service Workers and its handling of Secure Contexts. The vulnerability arises when Chrome before 52.0.2743.82 makes decisions about whether to control a subframe, potentially allowing a remote attacker to bypass the Same Origin Policy through an http...

CVE-2016-5143

CVE-2016-5143 affects Google Chrome’s Blink DevTools prior to 52.0.2743.116 and involves mishandling of the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter. This allows remote attackers to bypass intended access restrictions via a crafted URL. Connected Debian advisori...

CVE-2016-5161

CVE-2016-5161 affects Blink (WebKit editing stack) used by Google Chrome. The issue arises in EditingStyle::mergeStyle, where mis-handling of custom properties allows a crafted site to trigger a type-confusion in StylePropertySerializer, enabling a remote attacker to cause a denial of service (an...

CVE-2016-5165

CVE-2016-5165 is a Cross-site Scripting vulnerability in Google Chrome’s DevTools (DevTools subsystem) allowing remote attackers to inject arbitrary web script or HTML via the settings parameter of a chrome-devtools-frontend.appspot.com URL query string. Affected: Google Chrome on Windows, macOS ...

CVE-2016-5214

CVE-2016-5214 is a Chromium/Chrome download-protection bypass due to insufficient validation. The issue was disclosed in multiple advisories and is associated with the Chromium/Chrome download handling component, enabling a remote attacker to bypass the Mark of the Web protection via crafted HTML...

CVE-2017-15427

CVE-2017-15427 is a Chrome Omnibox cross-site scripting vulnerability reported as: insufficient policy enforcement in Omnibox allowed a user to XSS themselves by dragging and dropping a javascript: URL into the URL bar, affecting Chrome versions before 63.0.3239.84. Connected sources confirm the ...

CVE-2017-5019

CVE-2017-5019 describes a use-after-free vulnerability in Google Chrome leading to possible heap corruption. It affects Chrome prior to 56.0.2924.76 on Linux, Windows, and Mac, and 56.0.2924.87 on Android. The issue could be triggered by a crafted HTML page served in a remote context, enabling a ...

CVE-2017-5020

CVE-2017-5020 concerns Google Chrome prior to 56.0.2924.76 (Linux/Windows/macOS) and 56.0.2924.87 (Android). The issue arises from failing to require a user gesture for powerful download operations, which could let a remote attacker who tricks a user into installing a malicious extension execute ...

CVE-2017-5118

CVE-2017-5118 describes a CSP bypass in Blink used by Google Chrome (Mac/Win/Linux) and Chromium builds, where CSP restrictions were not correctly propagated to javascript: scheme pages. The underlying issue allowed a remote attacker to bypass the Content Security Policy via a crafted HTML page. ...

CVE-2017-5125

CVE-2017-5125 affects Chromium/Chromium‑Browser (Skia) prior to 62.0.3202.62. Root cause: a heap overflow in the Skia component that can be triggered by a crafted HTML page. Impact: remote attacker could potentially execute arbitrary code within the browser context; impact details are cited acros...

CVE-2023-7012

CVE-2023-7012 affects Google Chrome’s Permission Prompts due to insufficient data validation, potentially enabling a sandbox escape when a user runs a malicious app. Described for Chrome versions before 117.0.5938.62; exploitation requires user interaction and a malicious file. Astra Linux bullet...

CVE-2026-11161

CVE-2026-11161 affects Google Chrome due to an inappropriate implementation in DataTransfer. A crafted HTML page can leak cross-origin data, as described for Chrome versions prior to 149.0.7827.53. The described impact is a cross-origin data leak with Medium severity. The fix is to update to Chro...

CVE-2026-11247

Google Chrome on Android CustomTabs had insufficient policy enforcement before version 149.0.7827.53, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: policy enforcement gaps in CustomTabs; impact: cross-origin data leakage. References indicate a patch in ...

CVE-2026-13022

CVE-2026-13022 affects Google Chrome up to version 149.0.7827.196/197 (prior to 149.0.7827.197). The issue is an inappropriate implementation in Autofill within the Chromium-based renderer, enabling a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted...

CVE-2026-14113

The CVE-2026-14113 entry describes a use-after-free in Chrome’s Updater on Windows before 150.0.7871.47. A remote attacker who already compromised the renderer could potentially escape the sandbox via a crafted HTML page. The issue is tied to the Chromium-based Updater component; exact root cause...

CVE-2026-14398

In Connected sources, CVE-2026-14398 is described as a Use-after-free in ANGLE affecting Google Chrome prior to 150.0.7871.46, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is confirmed as part of ANGLE in Chrome, with a critical severity....

CVE-2026-16418

CVE-2026-16418 describes a stack buffer overflow in the V8 engine of Google Chrome (Chromium) before version 150.0.7871.182, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product is Google Chrome (Chromium-based) on desktop Windows; expl...

CVE-2026-17657

CVE-2026-17657 affects Google Chrome desktop prior to version 151.0.7922.72. The vulnerability is a use-after-free in Navigation that, if a renderer process is already compromised, could enable a sandbox escape via a crafted HTML page. Chrome’s July 2026 stable-channel update addresses this, with...

CVE-2026-17859

CVE-2026-17859 concerns an inappropriate implementation in Chrome’s favicon handling that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is described as affecting Google Chrome prior to version 151.0.7922.72, with a Chromium security severity of...

CVE-2026-19156

CVE-2026-19156 affects Google Chrome before 151.0.7922.109. Description: heap buffer overflow in Base allows exploitation via a crafted Chrome Extension after user installs a malicious extension. Impact is high; Chrome update 151.0.7922.109 addresses the issue (stable channel). Other sources (EUV...

CVE-2026-5290

CVE-2026-5290 is a use-after-free in Chrome/Chromium’s Compositing pathway that, if the renderer is already compromised, could enable a sandbox escape via a crafted HTML page. The vulnerability affects Chrome prior to version 146.0.7680.178; Google’s update to 146.0.7680.178 (and newer) fixes thi...

CVE-2026-79212

CVE-2026-79212 is a missing authorization flaw in the Passwords component of Google Chrome prior to 152.0.7977.65 (Windows, Mac, Linux). A remote attacker who had already compromised the browser's renderer process could leverage social engineering to bypass the web origin policy via a crafted HTM...